Skip to main content

SharePoint Connector Documentation

If you have already set up a connector, skip to How to Use the SharePoint Connector.

Connect your SharePoint to Abacus.AI​

To integrate SharePoint with Abacus.AI, you need to set up the connector and provide the necessary permissions.

Setting Up the SharePoint Connector​

Flow 1: OAuth Based Setup​

  1. Before setting up the SharePoint Connector with OAuth, ensure that you have the necessary permissions to generate an OAuth token for accessing your SharePoint site.

  2. Access Connected Services Dashboard:

  3. Add New Connector:

    • Click on the "Add New Connector" option, select "SharePoint" from the list, enter your site URL and click on tick mark beside the site URL.

  4. Select "OAuth" from the 'Authentication Type' dropdown.

  5. Enable Realtime Synced Datasets (Optional):

    • Toggle the "Enable Realtime Synced Datasets" option to Yes if you want to sync datasets in real time.

  6. Admin Mode (Optional):

    • Toggle the "Admin Mode" option to Yes if you want the AbacusAI_Sharepoint_Connector Entra app itself (rather than your user account) to obtain the access token and make the SharePoint/Graph API calls. This requires an org admin to grant admin consent to the app, and switches the connector from delegated permissions to application-level permissions.

  7. Enable Multi-Site Selection (Optional):

    • If you want to pull data from multiple SharePoint sites, toggle the "Pull from Multiple Sites" option to Yes.
    • Enter the SharePoint domain in the "SharePoint Domain" field. The domain must end with sharepoint.com.
    • Use the + button to add multiple site names or enter them as comma-separated values in the "Sites" field.

  8. Skip Sensitivity Labels (Optional):

    • If your SharePoint environment uses Microsoft Purview sensitivity labels, you can exclude files with specific sensitivity labels during data ingestion.
    • Enter a comma-separated list of sensitivity label names in the "Skip Sensitivity Labels" field to skip files matching those labels.
    • Ensure the SensitivityLabels.Read.All application permission is granted with admin consent for this feature to work.

  9. Click on Connect Sharepoint button to create and save the connector.

Flow 2: Personal Service Principal Setup with certificates​

  1. Select Authentication Type:

    • Go to the Abacus.AI Connected Services Dashboard. You can click your profile in the top right and then click "Manage Connectors".
    • Click on the "Add New Connector" option, select "SharePoint" from the list, and choose "Personal Service Principal" as the authentication type.

  2. Enter Client ID:

    • Provide the Client ID for your Personal Service Principal.

  3. Optional Configurations:

    • If you want to pull data from multiple SharePoint sites, toggle the "Pull from Multiple Sites" option to Yes.
    • Note: The "Enable Realtime Synced Datasets" option is only available for the OAuth Based flow and is not applicable here.
    • Skip Sensitivity Labels (Optional): If your SharePoint environment uses Microsoft Purview sensitivity labels, enter a comma-separated list of sensitivity label names to exclude files matching those labels during data ingestion. Ensure the SensitivityLabels.Read.All application permission is granted for this feature to work.

  4. Save and Verify:

    • Click "Save". A popup box will appear with a certificate. Download this certificate as it will be required for the next steps.

  5. Grant Permissions in Microsoft:

  6. Upload the Certificate:

    • Follow the instructions provided in the popup box to upload the certificate and complete the verification process.

  7. Verify Connector Status:

    • Once the permissions are granted and the certificate is uploaded, the connector should be set up and display an "ACTIVE" status.

Flow 3: Custom OAuth​

  1. Access Connected Services Dashboard:

  2. Add New Connector:

    • Click on the "Add New Connector" option, select "SharePoint" from the list, enter your site URL and click on tick mark beside the site URL.

  3. Select "Custom OAuth" from the 'Authentication Type' dropdown.

  4. Use your own OAuth app and grant it access to read data.

  • Copy the app's Client ID and Client Secret, then enter them into the Client ID and Client Secret fields.
  • Add the redirect URI https://abacus.ai/oauth/callback to your OAuth app so that Abacus.AI can complete the OAuth authorization flow. Note: Please refer to Microsoft documentation to create the app and add necessary scopes to app.

  1. Skip Sensitivity Labels (Optional):

    • If your SharePoint environment uses Microsoft Purview sensitivity labels, enter a comma-separated list of sensitivity label names to exclude files matching those labels during data ingestion.
    • Ensure the SensitivityLabels.Read.All application permission and SensitivityLabel.Read delegated permission are added to your custom OAuth app.

  2. Click on Connect Sharepoint button to create and save the connector.

User connector flow​

  1. Turn Config Only toggle ON:
  • Go to the Abacus.AI Connected Services Dashboard. You can click your profile in the top right and then click "Manage Connectors".
  • Click on the "Add New Connector" option, select "SharePoint" from the list, and turn "Config Only" toggle on.
Config Only
  1. Select Authentication Type:
  • Select "Basic" if you want to use Abacus.AI app for read only Sharepoint user connector.
  • Select "Write" if you want to use Abacus.AI app for read and write Sharepoint user connector.
  • Select "Custom Auth" if you want to use your own app with Sharepoint User connector.
Config Only Authentication
  1. Enter credentials:
  • Enter Sharepoint site URL
  • Enter client ID and secret if you have selected "Custom Auth".
  1. Turn Multi User Connector toggle ON: (Optional)
  • Turn this toggle ON only if you want to use the multiple Sharepoint config connectors to connect to multiple Sharepoint environments.
Multi user connector

Note: See Permissions and Access → User Connector Flow for the full list of permissions requested for the user connector (all delegated permissions).

Navigate to Sharepoint user connector public documentation to create a user connector.

How to Use the SharePoint Connector​

Once the SharePoint connector is set up, you can fetch data to train models in Abacus.AI.

  1. Create a new project and select the use case, then go to the "Datasets" tab and click "Create Dataset".
Create Dataset
  1. Click on "Create New".
Create New Dataset
  1. Name the dataset, select the data type 'List of documents', and click "Continue".
Name Dataset

  1. Choose "Read from External Service" and select your SharePoint connector under "Connected Application Connectors".

  2. Enter the Site URL for the SharePoint site you want to use, and specify the folder path if you have set up the connector to pull from a specific folder.

  3. After the dataset is uploaded, configure the schema mapping and proceed to train models with the data.

Train Model with Data

Supported Data Types​

  • Supported Data Types: The SharePoint connector supports ingesting documents and files. Documents and files are treated as a list of documents, suitable for unstructured data use in ChatLLM projects.

Using SharePoint Data with LLMs​

  • ChatLLM Use Case: SharePoint documents, such as PDFs, Word files, and other unstructured data, are ideal for conversational AI use cases. These documents are ingested as a list of documents and processed into a Document Retriever for retrieval-augmented generation (RAG).

Feature Group Types​

  • List of Documents: Used for unstructured data, such as uploaded documents, in ChatLLM projects. These feature groups require processing into a Document Retriever for retrieval-augmented generation (RAG).

By combining both feature group types, you can handle both unstructured and structured data effectively in a single project.

Microsoft Access Scopes and Their Purpose​

The following Microsoft scopes are required across connectors that use Microsoft authentication. These scopes ensure secure access, profile verification, dataset creation, and SharePoint integration.

  • General Mandatory Scopes​

    • User.Read – Identifies and validates the signed-in user and provides basic profile information.
    • offline_access – Provides refresh tokens so authentication persists without repeated sign-ins.

Permissions and Access​

The exact permissions requested depend on which authentication type and options you choose. The tables below list what is required for each combination.

Admin Mode is required whenever you want the Entra app itself — not the signed-in user — to obtain the access token and make the SharePoint/Graph API calls. This is what switches the connector from delegated permissions to application-level permissions requiring admin consent.

Flow 1: OAuth (Admin Mode off)​

By default (Admin Mode toggled No), the connector uses delegated permissions consented to by the signed-in user only — no admin consent is required.

Graph API scopes (delegated)

  • Sites.Read.All: Read items in all site collections
  • Files.Read.All: Read all files that user can access
  • offline_access: Maintain access to data you have given it access to
  • SensitivityLabel.Read: Read the user's sensitivity labels (Optional: added only if using Skip Sensitivity Labels)

SharePoint scopes (delegated)

  • AllSites.Read: Read items in all site collections
  • MyFiles.Read: Read user files

Toggling Admin Mode to Yes means the AbacusAI_Sharepoint_Connector Entra app itself gets the access token and makes the API calls, using application-level permissions instead of the signed-in user's delegated permissions. An org admin must grant consent for these:

Graph API scopes (application)

  • Files.Read.All: Read files in all site collections
  • Sites.Read.All: Read items in all site collections
  • Sites.Selected: Access selected site collections
  • SensitivityLabels.Read.All: Get labels tenant scope (Optional: required only if using Skip Sensitivity Labels)
  • Directory.Read.All: Read directory data (Optional: required for permission aware SharePoint connector)
  • GroupMember.Read.All: Read all group memberships (Optional: required for permission aware SharePoint connector)
  • User.Read.All: Read all users' full profiles (Optional: required for permission aware SharePoint connector)
  • User.ReadBasic.All: Read all users' basic profiles (Optional: required for permission aware SharePoint connector)

SharePoint scopes (application)

  • Sites.FullControl.All: Have full control of all site collections (Optional: required for permission aware SharePoint connector)
  • Sites.Read.All: Read items in all site collections (Optional)
  • Sites.Selected: Access selected site collections (Optional)

Flow 1: OAuth with Realtime Synced Datasets enabled​

Realtime Synced Datasets work over the same delegated OAuth flow as above — Admin Mode is optional and does not need to be enabled, though it can also be enabled if you want the connector to use application-level permissions instead. Enabling "Enable Realtime Synced Datasets" adds the following scopes to the same delegated OAuth consent (or to the Admin Mode application permissions, if Admin Mode is also enabled):

Graph API scopes (delegated)

  • Sites.Read.All: Read items in all site collections
  • Files.Read.All: Read all files that user can access
  • offline_access: Maintain access to data you have given it access to
  • GroupMember.Read.All: Read all group memberships
  • Directory.Read.All: Read directory data

SharePoint scopes (delegated)

  • AllSites.Read: Read items in all site collections
  • MyFiles.Read: Read user files
  • AllSites.FullControl: Have full control of all site collections

Flow 2: Personal Service Principal Permissions​

These are application-level permissions that you grant directly to your Personal Service Principal in Microsoft Entra (see step 5 of setup):

  • Files.Read.All: Read files in all site collections
  • Sites.Read.All: Read items in all site collections
  • Sites.Selected: Access selected site collections
  • SensitivityLabels.Read.All: Read sensitivity labels and their policy settings (Optional: required only if using Skip Sensitivity Labels)

Note: Realtime Synced Datasets are not supported for this flow.

Flow 3: Custom OAuth Permissions​

Add the following scopes to your own Entra app (see necessary scopes in setup):

Delegated permissions (same as Flow 1: OAuth above)

  • Sites.Read.All, Files.Read.All, offline_access, AllSites.Read, MyFiles.Read

Additional permission for Skip Sensitivity Labels (Optional)

  • SensitivityLabels.Read.All (application permission)
  • SensitivityLabel.Read (delegated permission)

User Connector Flow (Basic / Write / Custom Auth)​

All permissions requested for the user connector flow are delegated permissions, consented to by each signed-in user:

Graph API scopes

  • Directory.Read.All: Read directory data
  • email: View users' email address
  • Files.Read.All: Read all files that user can access
  • offline_access: Maintain access to data you have given it access to
  • openid: Sign users in
  • profile: View users' basic profile
  • SensitivityLabel.Read: Read the user's sensitivity labels
  • Sites.Read.All: Read items in all site collections
  • Sites.Selected: Access selected Sites, on behalf of the signed-in user
  • User.Read: Sign in and read user profile

SharePoint scopes

  • AllSites.Read: Read items in all site collections
  • MyFiles.Read: Read user files
  • Sites.Search.All: Run search queries as a user
  • Sites.Selected: Access selected site collections
  • User.Read.All: Read user profiles

These permissions allow the connector to pull necessary data for analysis and model training.

Minimum Scopes required for Dataset creation​

SharePoint scopes (delegated):

  • AllSites.Read - Read items in all site collections
  • MyFiles.Read - Read user files

For Realtime SharePoint Dataset Permission:

  • All of the above SharePoint scopes, plus AllSites.FullControl (delegated SharePoint scope).
  • The following Graph scopes (delegated): Directory.Read.All, GroupMember.Read.All.

Troubleshooting and FAQ for the SharePoint connector​

Can I use multiple SharePoint connectors in Abacus.AI?

Yes, you can set up multiple SharePoint connectors in Abacus.AI, each with different configurations and permissions.

What's the right feature mapping schema that will allow documents to use the URLs of the original file location on the source page in the external chat portal?

To get the URLs to the original location of a file on the source page in the chatweb, you should set the URL as "Document source" instead of the file_path which is set as a document source by default.